Information Disclosure Vulnerability in Ritlabs TinyWeb 1.92

Reported June 03, 2004, by GSSIT
 

VERSIONS AFFECTED

DESCRIPTION
A vulnerability in Ritlabs TinyWeb 1.92 could result in information disclosure.A hacker could use TinyWeb to download and obtain the scripts located in a Website's cgi-bin directory by issuing a simple HTTP GET request to the Web serverfor the Uniform Resource Identifier (URI) /cgi-bin/./[Script Name].

VENDOR RESPONSE
Ritlabs has releasedversion 1.93, which isn't vulnerable to this condition.

CREDIT
Discovered by GSSIT.